Static Asset Security Issue in Current Heat Clinic

Suggest features you would like to see in Broadleaf Commerce

Moderator: jocanas

phillipuniverse
Team Member
Team Member
Posts: 1563
Joined: Tue Dec 20, 2011 12:11 pm

Static Asset Security Issue in Current Heat Clinic

Postby phillipuniverse » Fri Dec 07, 2012 1:09 pm

Since this effects everyone currently running the demo site, I thought it would be a good idea to mention it here. The main cause for this is when you have assigned a static asset as the primary image for a product, and is manifested when you add that product to the cart and go to checkout. Common symptoms include:

  • Session being reset on an incorrect form submission on the checkout page, which will then invalidate your session (and cause CSRF exceptions if you try to resubmit the form)
  • SSL warnings when viewing /checkout as the static asset is being served over http (the browser first requests the image over https, but the application then redirects to actually serve the image over http)
  • NullPointerExceptions in SessionFixationProtectionCookie when requesting static assets

The main cause of this is that there is no explicit mapping defined for the static assets, and thus the application treats them as though they should be served over http, based on this snipping in applicationContext-security (in site and combined):

Code: Select all

<!-- All URLs not explicitly specified as https will be served under http -->
<sec:intercept-url pattern="/" requires-channel="http"/>
<sec:intercept-url pattern="/**" requires-channel="http"/>


The fix is to ensure that static assets are treated just like any other static resource. So in applicationContext-security.xml in site and applicationContext-security-combined.xml add the following lines underneath where the other asset paths are defined (like /img/** and /robots.txt):

Code: Select all

<sec:http pattern="/**/${asset.server.url.prefix.internal}/**" security="none" />


This will prevent any static assets from going through Spring Security, and correctly serve the assets over http or https depending on what the browser is requesting. This has been updated on the Heat Clinic and it is recommended that you add this to your application ASAP.

For more information, you can view the Jira ticket at http://jira.broadleafcommerce.org/browse/BLC-798

limebot
Junior
Junior
Posts: 37
Joined: Mon Jul 30, 2012 12:20 pm
Location: Columbus, Ohio
Contact:

Re: Static Asset Security Issue in Current Heat Clinic

Postby limebot » Thu Jan 03, 2013 4:58 pm

My version of the Demo Application is missing the combined folder for the applicationContext-security-combined.xml file.
Can I just add the line to only the applicationContext-security.xml file only?
DWetherell

phillipuniverse
Team Member
Team Member
Posts: 1563
Joined: Tue Dec 20, 2011 12:11 pm

Re: Static Asset Security Issue in Current Heat Clinic

Postby phillipuniverse » Fri Jan 04, 2013 10:27 am

Yes.


Return to “Suggested Features”

Who is online

Users browsing this forum: No registered users and 1 guest